@prestyj/cli 5.28.0 → 5.29.0

package/dist/core/shell-threats.js

@@ -0,0 +1,186 @@
+/**
+ * Local, deterministic shell-threat rules. Run against every command the
+ * agent is about to execute (bash tool, task_send input) and refuse the
+ * clearly-dangerous shapes: pipe-to-shell installers, reverse shells, secret
+ * exfiltration, lookalike (IDN/punycode) hosts and terminal-escape tricks.
+ *
+ * These are regexes over the full command text, not a shell parser. Known
+ * trade-off: quoted text inside `echo`/`printf` (e.g. `echo "curl x | sh"`)
+ * may be flagged too. That false positive is acceptable — the agent can write
+ * such text to a file with the write tool instead.
+ */
+import { extractCommandHosts, hostFromUrl } from "./network-guard.js";
+const SHELLS = "(?:sudo\\s+)?(?:[\\w./-]*/)?(?:sh|bash|zsh|dash|ksh|python[\\d.]*|node|perl|ruby)\\b";
+const FETCHERS = "\\b(?:curl|wget)\\b";
+const PIPE_TO_SHELL = [
+    // curl … | sh  (any number of intermediate pipeline stages)
+    // An interpreter given an inline script (-c/-e/-m/-p) or a script file reads
+    // stdin as data (`curl … | python -m json.tool`), so that is not flagged.
+    new RegExp(`${FETCHERS}[^;&\\n]*\\|\\s*${SHELLS}(?!\\s+(?:-[cmepE]\\b|--eval\\b|--print\\b|[^-\\s|;&]))`, "i"),
+    // bash <(curl …)
+    new RegExp(`${SHELLS}\\s+<\\(\\s*(?:curl|wget)\\b`, "i"),
+    // sh -c "$(curl …)"  /  $(wget …) / `curl …` executed
+    new RegExp(`${SHELLS}\\s+(?:-\\w+\\s+)*["']?\\$\\(\\s*(?:curl|wget)\\b`, "i"),
+    new RegExp(`${SHELLS}\\s+(?:-\\w+\\s+)*["']?\`\\s*(?:curl|wget)\\b`, "i"),
+    // eval "$(curl …)"
+    /\beval\s+["']?\$\(\s*(?:curl|wget)\b/i,
+    // PowerShell: iex (iwr …) / irm … | iex / Invoke-Expression
+    /\b(?:iex|invoke-expression)\b[\s(]*(?:\(?\s*)(?:iwr|irm|invoke-webrequest|invoke-restmethod|\(?new-object\s+net\.webclient)/i,
+    /\b(?:iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]*\|\s*(?:iex|invoke-expression)\b/i,
+    /\binvoke-expression\b/i,
+];
+const REVERSE_SHELL = [
+    /\/dev\/(?:tcp|udp)\//i,
+    // Case-sensitive: nc flags are case-significant (`-C` is CRLF, not `-c`).
+    /\b(?:nc|ncat|netcat)\b[^|;&\n]*\s(?:-[a-zA-Z]*[ec]\b|--exec\b|--sh-exec\b|-e\S|-c\S)/,
+    /\bsocat\b[^\n]*\b(?:exec|system):/i,
+    /\bbash\s+-i\s*>&/i,
+];
+/** python -c / perl -e one-liners that open a socket and connect/spawn. */
+function isScriptReverseShell(command) {
+    if (!/\b(?:python[\d.]*\s+-c|perl\s+-e)\b/i.test(command))
+        return false;
+    return /\bsocket\b/i.test(command) && /\b(?:connect|subprocess|exec)\b/i.test(command);
+}
+const SECRET_SOURCES = [
+    /~\/\.ssh\//,
+    /\.ssh\//,
+    /\bid_(?:rsa|ed25519|ecdsa|dsa)\b/,
+    /\.aws\/credentials\b/,
+    /\.ezcoder\/auth\.json\b/,
+    /\.netrc\b/,
+    /\.npmrc\b/,
+    // `.env` / `.env.local` as a path component, but not `.env.example`/`.env.sample`.
+    /(?:^|[\s/'"=@<])\.env(?!\.(?:example|sample|template|dist)\b)(?:\.[\w-]+)?(?=$|[\s'"|;&)>])/,
+    /\bsecurity\s+find-(?:generic|internet)-password\b/,
+    /(?:^|[;&|(]\s*)(?:printenv|env)\s*(?:\||$)/m,
+];
+const NETWORK_SINKS = [
+    // Case-sensitive: `-f`/`-t`/`-D` are not upload flags. A short cluster such
+    // as `-sd` counts only when the data flag is last (it takes the value).
+    /\bcurl\b[^\n]*\s(?:-[a-zA-Z]*[dFT]|--data(?:-\w+)?|--form(?:-string)?|--upload-file)(?=[\s=@'"]|$)/,
+    /\bcurl\b[^\n]*\s@\S/i,
+    /\bwget\b[^\n]*--post-(?:data|file)\b/i,
+    /\b(?:nc|ncat|netcat)\s/i,
+    /\b(?:scp|rsync)\b[^\n]*\s[\w.@-]+:/i,
+    /\bxargs\b[^\n]*\b(?:curl|wget)\b/i,
+    /\bfind\b[^\n]*-exec\s+(?:curl|wget)\b/i,
+];
+// eslint-disable-next-line no-control-regex -- matching ESC is the point
+const TERMINAL_TRICK = /[\u001b\u202a-\u202e\u2066-\u2069\u200b-\u200d\u2060\ufeff]/u;
+function codepoint(ch) {
+    return `U+${(ch.codePointAt(0) ?? 0).toString(16).toUpperCase().padStart(4, "0")}`;
+}
+/** Programs whose bare dotted operands are hostnames (`ping аpple.com`). */
+const NETWORK_PROGRAMS = new Set([
+    "curl",
+    "wget",
+    "ping",
+    "ssh",
+    "scp",
+    "sftp",
+    "rsync",
+    "git",
+    "nc",
+    "ncat",
+    "netcat",
+    "telnet",
+    "ftp",
+    "dig",
+    "nslookup",
+    "host",
+    "http",
+    "https",
+]);
+/**
+ * Candidate hostnames: URL authorities anywhere, plus bare dotted operands of
+ * network programs only — so non-ASCII file names (`cat résumé.pdf`) pass.
+ */
+function candidateHosts(command) {
+    const out = new Set();
+    for (const m of command.matchAll(/[a-z][a-z0-9+.-]*:\/\/(?:[^@\s/'"]*@)?([^\s/:'"?#]+)/giu)) {
+        if (m[1])
+            out.add(m[1].toLowerCase());
+    }
+    for (const segment of command.split(/(?:&&|\|\||[;|\n])/)) {
+        const tokens = segment.split(/[\s'"()<>]+/).filter((t) => t.length > 0);
+        if (tokens[0] === "sudo")
+            tokens.shift();
+        const program = (tokens[0] ?? "").split("/").pop() ?? "";
+        if (!NETWORK_PROGRAMS.has(program))
+            continue;
+        for (const token of tokens.slice(1)) {
+            const bare = token.replace(/^[\w.-]*@/, "").split(/[/:?#]/)[0] ?? "";
+            if (/^[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+$/u.test(bare) && /\p{L}/u.test(bare)) {
+                out.add(bare.toLowerCase());
+            }
+        }
+    }
+    for (const host of extractCommandHosts(command))
+        out.add(host);
+    return [...out];
+}
+function lookalikeThreats(command) {
+    const threats = [];
+    const seen = new Set();
+    for (const host of candidateHosts(command)) {
+        const nonAscii = /[^\p{ASCII}]/u.test(host);
+        const punycodeLabel = host.split(".").some((label) => label.startsWith("xn--"));
+        if (!nonAscii && !punycodeLabel)
+            continue;
+        const ascii = nonAscii ? (hostFromUrl(`http://${host}`) ?? host) : host;
+        if (seen.has(ascii))
+            continue;
+        seen.add(ascii);
+        threats.push({
+            rule: "lookalike-host",
+            severity: "block",
+            detail: nonAscii
+                ? `host "${host}" contains non-ASCII characters (resolves as ${ascii}) — likely a lookalike of a real domain`
+                : `host "${host}" uses a punycode (xn--) label — likely a lookalike of a real domain`,
+        });
+    }
+    return threats;
+}
+export function checkShellThreats(command) {
+    const threats = [];
+    const trick = TERMINAL_TRICK.exec(command);
+    if (trick) {
+        threats.push({
+            rule: "terminal-tricks",
+            severity: "block",
+            detail: `command contains invisible/control character ${codepoint(trick[0])} (ANSI escape, bidi override or zero-width) that can hide what actually runs`,
+        });
+    }
+    if (PIPE_TO_SHELL.some((re) => re.test(command))) {
+        threats.push({
+            rule: "pipe-to-shell",
+            severity: "block",
+            detail: "remote content is executed directly by a shell/interpreter. Download it to a file first " +
+                "(e.g. `curl -fsSL -o install.sh <url>`), read it, then run it.",
+        });
+    }
+    if (REVERSE_SHELL.some((re) => re.test(command)) || isScriptReverseShell(command)) {
+        threats.push({
+            rule: "reverse-shell",
+            severity: "block",
+            detail: "command matches a reverse-shell pattern (remote shell access over a socket)",
+        });
+    }
+    if (SECRET_SOURCES.some((re) => re.test(command)) &&
+        NETWORK_SINKS.some((re) => re.test(command))) {
+        threats.push({
+            rule: "secret-exfil",
+            severity: "block",
+            detail: "command reads secret material (keys, credentials, .env, environment) and sends data over the network",
+        });
+    }
+    threats.push(...lookalikeThreats(command));
+    return threats;
+}
+/** First blocking threat as a refusal message, or null when the command may run. */
+export function shellThreatBlockMessage(command) {
+    const threat = checkShellThreats(command).find((t) => t.severity === "block");
+    return threat ? `Blocked by shell safety check (${threat.rule}): ${threat.detail}` : null;
+}
+//# sourceMappingURL=shell-threats.js.map

package/dist/core/shell-threats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-threats.js","sourceRoot":"","sources":["../../src/core/shell-threats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQtE,MAAM,MAAM,GACV,sFAAsF,CAAC;AACzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAEvC,MAAM,aAAa,GAAsB;IACvC,4DAA4D;IAC5D,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,MAAM,CACR,GAAG,QAAQ,mBAAmB,MAAM,yDAAyD,EAC7F,GAAG,CACJ;IACD,iBAAiB;IACjB,IAAI,MAAM,CAAC,GAAG,MAAM,8BAA8B,EAAE,GAAG,CAAC;IACxD,sDAAsD;IACtD,IAAI,MAAM,CAAC,GAAG,MAAM,mDAAmD,EAAE,GAAG,CAAC;IAC7E,IAAI,MAAM,CAAC,GAAG,MAAM,+CAA+C,EAAE,GAAG,CAAC;IACzE,mBAAmB;IACnB,uCAAuC;IACvC,4DAA4D;IAC5D,8HAA8H;IAC9H,4FAA4F;IAC5F,wBAAwB;CACzB,CAAC;AAEF,MAAM,aAAa,GAAsB;IACvC,uBAAuB;IACvB,0EAA0E;IAC1E,sFAAsF;IACtF,oCAAoC;IACpC,mBAAmB;CACpB,CAAC;AAEF,2EAA2E;AAC3E,SAAS,oBAAoB,CAAC,OAAe;IAC3C,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,cAAc,GAAsB;IACxC,YAAY;IACZ,SAAS;IACT,kCAAkC;IAClC,sBAAsB;IACtB,yBAAyB;IACzB,WAAW;IACX,WAAW;IACX,mFAAmF;IACnF,6FAA6F;IAC7F,mDAAmD;IACnD,6CAA6C;CAC9C,CAAC;AAEF,MAAM,aAAa,GAAsB;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,oGAAoG;IACpG,sBAAsB;IACtB,uCAAuC;IACvC,yBAAyB;IACzB,qCAAqC;IACrC,mCAAmC;IACnC,wCAAwC;CACzC,CAAC;AAEF,yEAAyE;AACzE,MAAM,cAAc,GAAG,8DAA8D,CAAC;AAEtF,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,KAAK;IACL,UAAU;IACV,MAAM;IACN,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa;YAAE,SAAS;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;gBACd,CAAC,CAAC,SAAS,IAAI,gDAAgD,KAAK,yCAAyC;gBAC7G,CAAC,CAAC,SAAS,IAAI,sEAAsE;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,gDAAgD,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,8EAA8E;SAC1J,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,0FAA0F;gBAC1F,gEAAgE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,6EAA6E;SACtF,CAAC,CAAC;IACL,CAAC;IAED,IACE,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC5C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,OAAO;YACjB,MAAM,EACJ,sGAAsG;SACzG,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,CAAC,CAAC,kCAAkC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC"}

package/dist/core/skills.js

@@ -2,8 +2,9 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { clampToBytes, CONTEXT_LIMITS } from "./context-limits.js";
-import { stripBom } from "../utils/text.js";
+import { cleanInstructionText } from "../utils/text.js";
 import { parseFrontmatter } from "./frontmatter.js";
+import { log } from "./logger.js";
 const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
 export const BUNDLED_SKILLS_DIRS = [
     // Single-file desktop sidecar: resources live beside app-sidecar.mjs.
@@ -121,10 +122,19 @@ async function loadSkillsFromDir(dir, source) {
  * Frontmatter values may be quoted or YAML block scalars (`description: >`).
  */
 export function parseSkillFile(rawInput, source) {
-    // A BOM before `---` would otherwise silently kill frontmatter parsing.
-    const { fields, body: content } = parseFrontmatter(stripBom(rawInput));
+    // A BOM before `---` would otherwise silently kill frontmatter parsing, and a
+    // skill or command shipped in a repo can hide instructions in invisible text.
+    const cleaned = cleanInstructionText(rawInput);
+    const { fields, body: content } = parseFrontmatter(cleaned.text);
     const name = fields.name ?? "";
     const description = fields.description ?? "";
+    if (cleaned.stripped > 0) {
+        log("WARN", "skills", "Stripped invisible characters from a skill file", {
+            name,
+            source,
+            stripped: cleaned.stripped,
+        });
+    }
     return { name, description, content, source };
 }
 /**
@@ -173,7 +183,9 @@ export function formatSkillsForPrompt(skills, limits = CONTEXT_LIMITS) {
         `Respect explicit exclusions in the description. Matching skill instructions specialize this prompt but do not override project or file/module rules.\n\n` +
         `Match the work, not the topic: a skill's subject matter appearing in the request is not a match when the actual change falls outside its scope. ` +
         `Skip the skill when the task is routine, narrow, or already covered by existing patterns in the codebase \u2014 an unnecessary invocation costs context and slows the task. ` +
-        `Invoke at most one skill unless the task genuinely spans two, and do not re-invoke a skill whose instructions are already in this conversation.\n\n` +
+        `Invoke at most one skill unless the task genuinely spans several, and do not re-invoke a skill whose instructions are already in this conversation. ` +
+        `Launch-readiness asks span every listed skill in scope, in order durable, bulletproof, compliance-guard, lean, evidence-led-ui: ` +
+        `one report-only child per skill in a single spawn_agent call; a failed child is reported as not checked, never as clean.\n\n` +
         list +
         overflow);
 }

package/dist/core/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/core/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC;IAClC,yDAAyD;IACzD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAChD,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG;IACzB,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAChD,CAAC;AAUF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAgC,kBAAkB;IAElD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAGrF,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;gBAAE,SAAS;YACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAoB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAWD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,MAAe,EAAQ,EAAE;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wDAAwD;IACxD,SAAS,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;IACrC,SAAS,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7E,SAAS,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAc;IAC1D,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,wCAAwC;QACxC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/D,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;gBACzC,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAE7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAe,EACf,SAAwB,cAAc;IAEtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;YACnC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY;QAC/D,IAAI,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAe,EACf,SAAwB,cAAc;IAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhG,OAAO,CACL,eAAe;QACf,gFAAgF;QAChF,4MAA4M;QAC5M,0JAA0J;QAC1J,kJAAkJ;QAClJ,8KAA8K;QAC9K,qJAAqJ;QACrJ,IAAI;QACJ,QAAQ,CACT,CAAC;AACJ,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/core/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC;IAClC,yDAAyD;IACzD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAChD,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG;IACzB,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAChD,CAAC;AAUF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAgC,kBAAkB;IAElD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAGrF,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;gBAAE,SAAS;YACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAoB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAWD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,MAAe,EAAQ,EAAE;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC;IAEF,2EAA2E;IAC3E,wDAAwD;IACxD,SAAS,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;IACrC,SAAS,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7E,SAAS,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAc;IAC1D,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,wCAAwC;QACxC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/D,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;gBACzC,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,iDAAiD,EAAE;YACvE,IAAI;YACJ,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAe,EACf,SAAwB,cAAc;IAEtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;YACnC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY;QAC/D,IAAI,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAe,EACf,SAAwB,cAAc;IAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8CAA8C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhG,OAAO,CACL,eAAe;QACf,gFAAgF;QAChF,4MAA4M;QAC5M,0JAA0J;QAC1J,kJAAkJ;QAClJ,8KAA8K;QAC9K,sJAAsJ;QACtJ,kIAAkI;QAClI,8HAA8H;QAC9H,IAAI;QACJ,QAAQ,CACT,CAAC;AACJ,CAAC"}

package/dist/core/stream-rules.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Loads stream rules (regex guards matched against the model's streaming
+ * output — see @prestyj/agent `stream-rules.ts`) from markdown files:
+ *
+ *   ~/.ezcoder/rules/*.md          user rules (trusted)
+ *   <cwd>/.ezcoder/rules/*.md      project rules (untrusted; override user rules by name)
+ *
+ * No rules ship built in. Example `.ezcoder/rules/no-console-log.md`:
+ *
+ *   ---
+ *   name: no-console-log
+ *   trigger: console\.log\(
+ *   scope: tool            # text | tool | both (default both)
+ *   tools: [edit, write]   # optional; restricts tool-scope matching
+ *   ---
+ *   Do not add console.log calls. Use the project logger (`log()` from
+ *   core/logger.ts) instead.
+ *
+ * `trigger` is a JavaScript regex source; `/source/flags` form is accepted
+ * with flags from `imsu`. The body is the reminder shown to the model when the
+ * rule fires (trimmed, capped at 1,000 chars). Project triggers longer than
+ * 300 chars or with nested quantifiers (catastrophic-backtracking risk) are
+ * skipped. Invalid files are skipped with a WARN log; loading never throws.
+ */
+import type { StreamRule } from "@prestyj/agent";
+export declare const MAX_STREAM_RULES = 50;
+export declare const MAX_STREAM_RULE_REMINDER_CHARS = 1000;
+export declare const MAX_PROJECT_TRIGGER_CHARS = 300;
+/** Load user + project stream rules. Project rules override user rules with the same name. */
+export declare function loadStreamRules(cwd: string, home?: string): Promise<StreamRule[]>;

package/dist/core/stream-rules.js

@@ -0,0 +1,151 @@
+/**
+ * Loads stream rules (regex guards matched against the model's streaming
+ * output — see @prestyj/agent `stream-rules.ts`) from markdown files:
+ *
+ *   ~/.ezcoder/rules/*.md          user rules (trusted)
+ *   <cwd>/.ezcoder/rules/*.md      project rules (untrusted; override user rules by name)
+ *
+ * No rules ship built in. Example `.ezcoder/rules/no-console-log.md`:
+ *
+ *   ---
+ *   name: no-console-log
+ *   trigger: console\.log\(
+ *   scope: tool            # text | tool | both (default both)
+ *   tools: [edit, write]   # optional; restricts tool-scope matching
+ *   ---
+ *   Do not add console.log calls. Use the project logger (`log()` from
+ *   core/logger.ts) instead.
+ *
+ * `trigger` is a JavaScript regex source; `/source/flags` form is accepted
+ * with flags from `imsu`. The body is the reminder shown to the model when the
+ * rule fires (trimmed, capped at 1,000 chars). Project triggers longer than
+ * 300 chars or with nested quantifiers (catastrophic-backtracking risk) are
+ * skipped. Invalid files are skipped with a WARN log; loading never throws.
+ */
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { parseFrontmatter } from "./frontmatter.js";
+import { log } from "./logger.js";
+export const MAX_STREAM_RULES = 50;
+export const MAX_STREAM_RULE_REMINDER_CHARS = 1000;
+export const MAX_PROJECT_TRIGGER_CHARS = 300;
+/** Heuristic for nested quantifiers like `(a+)+`, `(\w*)*`, `(x+){2,}`. */
+const NESTED_QUANTIFIER = /\([^)]*[+*][^)]*\)[+*{]/;
+const REGEX_LITERAL = /^\/(.+)\/([imsu]*)$/s;
+async function listRuleFiles(dir) {
+    try {
+        const entries = await fs.readdir(dir, { withFileTypes: true });
+        return entries
+            .filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".md"))
+            .map((e) => path.join(dir, e.name))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+function parseTools(raw) {
+    if (raw === undefined)
+        return undefined;
+    const tools = raw
+        .replace(/^\[|\]$/g, "")
+        .split(/[\s,]+/)
+        .map((t) => t
+        .replace(/^-+$/, "")
+        .replace(/^["']|["']$/g, "")
+        .trim())
+        .filter(Boolean);
+    return tools.length > 0 ? tools : undefined;
+}
+function parseScope(raw) {
+    if (raw === undefined || raw.trim() === "")
+        return "both";
+    const scope = raw.trim().toLowerCase();
+    return scope === "text" || scope === "tool" || scope === "both" ? scope : null;
+}
+function compileTrigger(trigger, origin) {
+    if (origin === "project") {
+        if (trigger.length > MAX_PROJECT_TRIGGER_CHARS) {
+            return `trigger exceeds ${MAX_PROJECT_TRIGGER_CHARS} chars`;
+        }
+        if (NESTED_QUANTIFIER.test(trigger))
+            return "trigger has nested quantifiers";
+    }
+    const literal = REGEX_LITERAL.exec(trigger);
+    try {
+        return literal ? new RegExp(literal[1], literal[2]) : new RegExp(trigger);
+    }
+    catch (err) {
+        return `invalid regex: ${err instanceof Error ? err.message : String(err)}`;
+    }
+}
+async function readRule(file, origin) {
+    const skip = (reason) => {
+        log("WARN", "stream-rules", `Skipping stream rule ${file}: ${reason}`);
+        return null;
+    };
+    let raw;
+    try {
+        raw = await fs.readFile(file, "utf8");
+    }
+    catch (err) {
+        return skip(`unreadable (${err instanceof Error ? err.message : String(err)})`);
+    }
+    const { fields, body, hasFrontmatter } = parseFrontmatter(raw);
+    if (!hasFrontmatter)
+        return skip("missing frontmatter");
+    const name = fields.name?.trim();
+    if (!name)
+        return skip("missing name");
+    const trigger = fields.trigger?.trim();
+    if (!trigger)
+        return skip("missing trigger");
+    const scope = parseScope(fields.scope);
+    if (!scope)
+        return skip(`invalid scope "${fields.scope ?? ""}"`);
+    const pattern = compileTrigger(trigger, origin);
+    if (typeof pattern === "string")
+        return skip(pattern);
+    const reminder = body.trim().slice(0, MAX_STREAM_RULE_REMINDER_CHARS);
+    if (!reminder)
+        return skip("empty reminder body");
+    const tools = parseTools(fields.tools);
+    return { name, pattern, scope, reminder, ...(tools ? { tools } : {}) };
+}
+async function loadDir(dir, origin) {
+    const rules = [];
+    for (const file of await listRuleFiles(dir)) {
+        const rule = await readRule(file, origin);
+        if (rule)
+            rules.push(rule);
+    }
+    return rules;
+}
+/** Load user + project stream rules. Project rules override user rules with the same name. */
+export async function loadStreamRules(cwd, home = os.homedir()) {
+    try {
+        const byName = new Map();
+        for (const rule of await loadDir(path.join(home, ".ezcoder", "rules"), "user")) {
+            byName.set(rule.name, rule);
+        }
+        const projectDir = path.join(cwd, ".ezcoder", "rules");
+        // cwd === home would load the same dir twice and apply untrusted limits to user rules.
+        if (path.resolve(projectDir) !== path.resolve(home, ".ezcoder", "rules")) {
+            for (const rule of await loadDir(projectDir, "project")) {
+                byName.delete(rule.name);
+                byName.set(rule.name, rule);
+            }
+        }
+        const rules = [...byName.values()];
+        if (rules.length > MAX_STREAM_RULES) {
+            log("WARN", "stream-rules", `Only the first ${MAX_STREAM_RULES} of ${rules.length} stream rules are used`);
+        }
+        return rules.slice(0, MAX_STREAM_RULES);
+    }
+    catch (err) {
+        log("WARN", "stream-rules", `Failed to load stream rules: ${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+}
+//# sourceMappingURL=stream-rules.js.map

package/dist/core/stream-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-rules.js","sourceRoot":"","sources":["../../src/core/stream-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAI7C,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;aAClC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC;SACE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CACV;SACA,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,MAAkB;IACzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC/C,OAAO,mBAAmB,yBAAyB,QAAQ,CAAC;QAC9D,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,gCAAgC,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAkB;IACtD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAQ,EAAE;QACpC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,wBAAwB,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,MAAkB;IACpD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,OAAe,EAAE,CAAC,OAAO,EAAE;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACvD,uFAAuF;QACvF,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;YACzE,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACpC,GAAG,CACD,MAAM,EACN,cAAc,EACd,kBAAkB,gBAAgB,OAAO,KAAK,CAAC,MAAM,wBAAwB,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,MAAM,EACN,cAAc,EACd,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/core/subagent-manager.d.ts

@@ -1,7 +1,8 @@
-import type { Message, Provider, ThinkingLevel } from "@prestyj/ai";
+import type { Message, Provider } from "@prestyj/ai";
 import { type AgentDefinition } from "./agents.js";
 import { SubAgentStore } from "./subagent-store.js";
 import type { AgentNotificationQueue } from "./agent-notifications.js";
+import type { AcceptanceCheck } from "./acceptance-checks.js";
 import { type SubAgentTokenUsage } from "../tools/subagent-shared.js";
 export type SubAgentState = "starting" | "running" | "completed" | "failed" | "interrupted" | "closed" | "reaped";
 export interface SubAgentSnapshot {
@@ -16,6 +17,18 @@ export interface SubAgentSnapshot {
     tool_use_count: number;
     token_usage: SubAgentTokenUsage;
     output?: string;
+    /**
+     * Engine-built receipt of the last turn's tool calls plus any paths the
+     * report names that the child never opened. Kept apart from `output` so
+     * wait()'s head truncation can never cut it and output parsers (the ideal
+     * reviewer) see the child's prose unchanged.
+     */
+    receipt?: string;
+    /**
+     * One-line verdict of the parent's acceptance checks for the last turn
+     * (`2/3 passed, 1 unverified`); the per-check lines ride in `receipt`.
+     */
+    acceptance?: string;
     error?: string;
     agent_name?: string;
     provider?: string;
@@ -30,12 +43,11 @@ export interface SubAgentManagerOptions {
     agents: AgentDefinition[];
     getProvider: () => Provider;
     getModel: () => string;
-    getThinkingLevel: () => ThinkingLevel | undefined;
     getCacheKey?: () => string | undefined;
     getBaseUrl?: () => string | undefined;
     /** Optional per-model concurrency cap (subagentMaxPerModel setting). Counted
-     *  against the RESOLVED child model — read-only agents may run on the fast
-     *  model, so they count under that model, not the parent's. Only ever
+     *  against the RESOLVED child model — an agent pinned to its own model id
+     *  counts under that model, not the parent's. Only ever
      *  reduces concurrency below the global ACTIVE_LIMIT. */
     getMaxPerModel?: () => number | undefined;
     onState?: (snapshot: SubAgentSnapshot) => void;
@@ -53,6 +65,8 @@ export interface SubAgentManagerOptions {
     store?: SubAgentStore;
     sessionRootDir?: string;
 }
+/** Children that may be starting or running at once. */
+export declare const ACTIVE_LIMIT = 8;
 /**
  * Wait budgets, aligned with the child's own `SUB_AGENT_TIMEOUT_MS` (10 min).
  * The previous 30s default and 5-min ceiling meant a parent waiting on a
@@ -101,13 +115,16 @@ export declare class SubAgentManager {
     waitForPersistence(): Promise<void>;
     /** Explicit per-spawn overrides. Used by harness-owned children (the
      * independent Ideal reviewer): a read-only tool list and/or a forced model —
-     * bypassing agent-definition routing entirely. */
+     * bypassing agent-definition routing entirely — and a shorter turn time
+     * limit, after which the child answers from what it has gathered. */
     spawn(taskName: string, task: string, agentName?: string, overrides?: {
         model?: string;
         tools?: readonly string[];
+        turnTimeoutMs?: number;
+        checks?: readonly AcceptanceCheck[];
     }): Promise<SubAgentSnapshot>;
     sendMessage(agentId: string, message: string): Promise<number>;
-    followup(agentId: string, task: string): Promise<SubAgentSnapshot>;
+    followup(agentId: string, task: string, checks?: readonly AcceptanceCheck[]): Promise<SubAgentSnapshot>;
     interrupt(agentId: string, collectResult?: boolean): Promise<SubAgentSnapshot>;
     subscribe(listener: (snapshot: SubAgentSnapshot) => void): () => void;
     list(): SubAgentSnapshot[];